General

  • Target

    68fddd22dc6569a851f3813b63991bc188eeb6ae7a4988d0eb80d2fc78503e29

  • Size

    480KB

  • Sample

    241104-zpvxzaxbpa

  • MD5

    846dc8d14ead283b5e1510a2b95739f6

  • SHA1

    7fabba8890b088c85a8298924a0a81f72e344051

  • SHA256

    68fddd22dc6569a851f3813b63991bc188eeb6ae7a4988d0eb80d2fc78503e29

  • SHA512

    221d5b626b1f038d12008aeb9736fecf2cee0ed6fea4ff9847c35993c0892d3743d26253bf7cbfde7a7221c16605b3c46bf692646f63f18289fc47f9cb6548ad

  • SSDEEP

    6144:KJy+bnr+Kp0yN90QEzPFkBLT5DXuVqBve7rYlnQ00TAKQsCE9ptmaZxGlj:vMr6y90FPFGAVqwnYlnA5Qsb9LmaZxi

Malware Config

Extracted

Family

redline

Botnet

dease

C2

217.196.96.101:4132

Attributes
  • auth_value

    82e4d5f9abc21848e0345118814a4e6c

Targets

    • Target

      68fddd22dc6569a851f3813b63991bc188eeb6ae7a4988d0eb80d2fc78503e29

    • Size

      480KB

    • MD5

      846dc8d14ead283b5e1510a2b95739f6

    • SHA1

      7fabba8890b088c85a8298924a0a81f72e344051

    • SHA256

      68fddd22dc6569a851f3813b63991bc188eeb6ae7a4988d0eb80d2fc78503e29

    • SHA512

      221d5b626b1f038d12008aeb9736fecf2cee0ed6fea4ff9847c35993c0892d3743d26253bf7cbfde7a7221c16605b3c46bf692646f63f18289fc47f9cb6548ad

    • SSDEEP

      6144:KJy+bnr+Kp0yN90QEzPFkBLT5DXuVqBve7rYlnQ00TAKQsCE9ptmaZxGlj:vMr6y90FPFGAVqwnYlnA5Qsb9LmaZxi

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks